hatchet-dev/hatchet Security Advisories | GitStock

medium2026-09-22

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

GHSA-992g-9cr3-vm5x · CVE-2026-88978

low2026-09-22

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

GHSA-9q4h-f4x5-ffq8 · CVE-2026-84298

medium2026-09-22

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

GHSA-g26x-m427-f48f · CVE-2026-63342

medium2026-09-22

Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

GHSA-fjwv-jf2v-j499 · CVE-2026-61681

high2026-09-21

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

GHSA-phg3-3g28-wq9v · CVE-2026-61687

medium2026-08-28

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

GHSA-8x7x-83cf-c3pg · CVE-2026-54746

medium2026-05-06

Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

GHSA-55gc-6fmc-fpx9 · CVE-2026-42572